ci: tokenless OIDC trusted publishing + lockstep versions [skip ci]

Release now publishes via npm trusted publishing (id-token, no NPM_TOKEN);
upgrades the runner npm to >=11.5.1 since pnpm publish delegates the upload
to npm. All published packages share one version via changesets `fixed`.

Author: lukaisailovic

.changeset/config.json

@@ -2,7 +2,17 @@
   "$schema": "https://unpkg.com/@changesets/config@3.0.0/schema.json",
   "changelog": "@changesets/cli/changelog",
   "commit": false,
-  "fixed": [],
+  "fixed": [
+    [
+      "openislands",
+      "@openislands/compiler",
+      "@openislands/connector-kit",
+      "@openislands/mcp",
+      "@openislands/runtime",
+      "@openislands/schema",
+      "@openislands/storage"
+    ]
+  ],
   "linked": [],
   "access": "public",
   "baseBranch": "main",

.github/workflows/release.yml

@@ -21,6 +21,9 @@ jobs:
           node-version: 22
           cache: pnpm
           registry-url: https://registry.npmjs.org
+      # Trusted publishing (OIDC) needs npm >= 11.5.1; Node 22 bundles npm 10.
+      # pnpm publish shells out to this npm for the actual upload.
+      - run: npm install -g npm@latest
       - run: pnpm install --frozen-lockfile
       - name: Version and publish
         run: |
@@ -38,5 +41,4 @@ jobs:
           git push origin HEAD:main
           git push origin --tags
         env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
           NPM_CONFIG_PROVENANCE: "true"